Category: Trends

Signs of the shift have appeared in a flurry of recent deals. Security giant Symantec is moving outside its niche with its pending purchase of storage maker Veritas Software. On the other side, networking company Cisco Systems and software giant Microsoft have snapped up fast-growing security companies, looking to give their own growth a boost.

This push toward diversification, coming amid widespread consolidation in many areas of the tech industry, has investment bankers and analysts wondering whether companies that specialize purely in security products can continue to thrive.

“There’s a debate whether the security market (will remain) its own market, over time–or will it be subsumed into two other markets, like the communications equipment market, or the networking or systems management industry?” said Kevin Sidders, a managing director at Credit Suisse First Boston. Sidders heads up U.S. software efforts in the investment bank’s technology group.

Some security players say the industry will stay as is, selling standalone products such as antivirus software. They note that network threats are evolving so rapidly that companies are continually being born to tackle the new problems.

Others, however, argue that the future of security lies in the technology being integrated at all levels of a company’s network, from the hardware to the interface, and that the recent merger-and-acquisition activity bears this out.

Rapid revenue growth in the security industry is a key factor driving the deals. Software, services and hardware companies in the sector will pull in $52.2 billion in sales in 2008, compared with $22.8 billion in 2003, predicts market research firm IDC.

That makes those businesses attractive targets for acquirers in the networking, communications and systems management industries, among others.

Still, some say that security companies may be stronger if they provide a soup-to-nuts IT package rather than a product to be bolted onto an existing network.

“Security, ultimately, will not be a standalone market,” said one investment banker who asked to remain anonymous. “It will just be just another layer of the infrastructure stack. It’s no longer about just making the security products work together.”

However it’s done, the important thing for the customer is to make the technology as smooth to use as possible, said Fred Rickabaugh, chief security officer at Premier, a Charlotte, N.C.-based provider of support services to health care companies. “I want the capability to build the ‘best of breed’ in certain areas were it’s critical,” Rickabaugh said.

In segments of the market where too few players exist to create competitive bidding, Rickabaugh said consolidation would benefit the customer by bringing one-stop shopping for multiple features.

Given this importance to customers, security businesses will wield influence.

Laura Koetzle, a security analyst with Forrester Research, said that security companies may find themselves part of a portfolio where they’re considered core to the future of the acquirer. “Security may be more of an influence as companies become blended,” Koetzle said.

Networking companies, for example, are finding that intrusion prevention technologies need to sit on top of or next to the network, in order to keep the data moving at a fast clip.

http://news.zdnet.com/2100-1009_22-5624251.html

The biggest problem when businesses are hit by a virus is user downtime.

The survey, completed last month by research firm InsightExpress and commissioned by SupportSoft Inc., a developer of software for managing software updates, portrays patch management as an ongoing issue that poses a variety of risks.

For example, patching still takes a week or longer at about a quarter of companies. That compares with 19% of respondents who say their IT organizations distribute patches to all computers within hours and 57% that do the job in days.

When asked how well prepared their IT organizations were for a virus attack, three-quarters are only “somewhat prepared,” compared with 21.3% that are completely prepared.

“It shows companies are struggling to get a handle on patching,” says Michael Cherry, an analyst with Directions On Microsoft.

The biggest concern among survey respondents is spyware, cited by 25%, followed by viruses and other kinds of malicious software. The most difficult part of patch management is an inability to update all systems with a single patch (24% of respondents) and the sheer number of patches that need to be distributed each month (21%).

Keeping up with Microsoft’s monthly security bulletins and associated software patches has been a challenge for some IT departments. In February, Microsoft issued a dozen security bulletins that addressed 17 vulnerabilities in Windows or its other products.

The negative effect most associated with viruses is end-user downtime, cited by 43% of respondents to the InsightExpress survey.

Chris Grejtak, senior VP of products and marketing with SupportSoft, says the survey underscores that remote and mobile computers are particularly hard to keep updated.

Microsoft’s Systems Management Server 2003 is used by some large companies to distribute updates to Microsoft products

http://www.securitypipeline.com/news/60405613;jsessionid=SUEDHZPSUU2BWQSNDBCCKHSCJUMEKJVN

A year ago, the $10 billion-a-year insurance provider received 2.6 million spam E-mails. By November, the number had nearly doubled to 4.8 million.

As if trying to keep missives offering cheap Viagra or get-rich-quick schemes out of in-boxes weren’t enough of a job, a steadily increasing onslaught of spyware and adware is further taxing IT resources. EFunds’ Jones is working to combat all types of attacks, whether they’re brought about by spyware or other means.

UnumProvident is one of a growing number of companies beginning to investigate anti-spyware products. By and large, companies allocate more IT dollars to fighting the twin scourges of spyware and adware, while continuing to pump time and money into keeping spam of every variety under control.

Just over 70% of 400 business-technology professionals recently surveyed by InformationWeek Research will spend somewhat or significantly more money to manage spyware, and more than 60% say the same of adware. E-mail accounted for half of inbound messages in 2004, up from 40% the year prior.

Two types of small applications can be installed on PCs by specially crafted E-mail messages, “free” software downloads, and other tricks. But they steal time from IT staffers, who must handle more help-desk calls from users who can’t get rid of pop-up ads and clean up systems suffering from performance slowdowns that stealth adware or spyware installations bring on.

Kim Jones, director of global security services for electronic financial processing company eFunds Corp., knows the problems adware can cause. Criminals and hackers use spyware such as keystroke loggers and Trojan horses to capture everything typed on PCs or to take control of systems to steal user names and passwords that could be used to attack and gain access to business resources. Last summer, Jones started using MainNerve Inc.’s Adaptive Darknet Service, a network of sensors scattered about the Internet spotting hacker command-and-control networks, which is constantly updated with attacking IP addresses.

McAfee this week adds spyware blocking capability to its McAfee IntruShield network intrusion prevention app, and it’s delivering a beta version of its Anti-Spyware Enterprise Edition Module that will work with its corporate anti-virus product.

Technology already has made a dent in spam problems. UnumProvident’s Fleury has seen results: The company uses spam filtering from SurfControl plc, and despite the uptick in spam being sent to users, employees aren’t seeing many of those messages in their in-boxes.

Cox now uses two CipherTrust Inc. secure E-mail appliances, and Warlick estimates they block 99% of the 38 million spam E-mails that head Cox’s way each month.

Spam is “now a security threat,” because more spam E-mails today contain adware or spyware that users unwittingly install.

http://www.securitypipeline.com/57701881

Steve Hunt, an analyst with Forrester Research, said in the report while companies have generally treated physical security as part of the facilities department and computer security as part of the information-technology group, employee information has increasingly become integrated, allowing businesses to link the two systems.

“Locks, cameras, entry systems, and even guard desks will be upgraded to work with the same computing systems that control computer and network sign-on, identity management and security incident management,” he wrote. “Consequently, IT security vendors will rush to merge or find partnerships with their physical security brethren to respond to the new opportunities.”

The link between physical security systems and network security is another ripple emanating from the events of 11 September, 2001. Spending on such integration will double compared with 2004, reaching $1.1bn in Europe and the United States in 2005, the report said.

US government projects to integrate physical and network security, such as the Transportation Worker’s Identity Card mandated by the Transportation Security Agency and the Common Access Card used by the Department of Defense, up the lion’s share of the money being spent, Forrester predicted. The federal government has focused on integrating physical and network security following the findings of the 9/11 Commission.

http://news.zdnet.co.uk/business/0,39020645,39183941,00.htm

Just ask Apple Computer, which filed two lawsuits in December accusing insiders and partners of leaking proprietary information. In one case, Apple is suing two men it says distributed prerelease versions of Tiger, the next iteration of Mac OS X. In a separate action, it is suing unnamed individuals who leaked details about a forthcoming music device code-named Asteroid.

Apple’s not the only company that’s found sensitive internal information leaked to the public. Big names such as America Online, Microsoft and Cisco Systems have also been victims.

Research indicates that most security breaches are inside jobs. A recent Ponemon Institute survey of 163 Fortune 1000 companies found that roughly 70 percent of all reported security breaches were due to insiders.

“It’s much more glamorous to think of the hacker who works for some large cyber-crime ring,” said Larry Ponemon, head of the Tuscon, Ariz., think tank. “But in reality, those characters only make up a small percent of the problem.”

For more than a decade, corporations have erected digital perimeters to keep outsiders off their networks. But now discontented, reckless and greedy employees, and disgruntled former workers, can all be bigger threats than the mysterious hacker. And as more companies outsource portions of their business, vital company information can easily fall into the wrong hands.

Securing information from the inside has been largely overlooked by many companies. But headline-grabbing incidents such as the one at Apple, along with new federal and state regulations for protecting private information, are causing many companies to rethink their security strategies from the inside out. As a result, a whole new class of products has sprung up aimed at keeping employees and other insiders from sending confidential information outside the company. Developing new techniques In addition to products that control who gets access to what information, a slew of new start-ups focus on securing digital content and watching where it goes. Products in this category vary in their approach.

Some focus solely on protecting intellectual property from being leaked, while others also perform forensics analysis, digital rights management and security policy management. Some products from companies like Vontu and Vericept act as gateways in the network to track sensitive information that is being sent outside of the network. They monitor e-mail, instant messages, FTP files, and other electronic communications on corporate networks, sniffing for leaks of Social Security numbers and other sensitive information. They only prevent information from being electronically sent over the network. They do nothing to prevent people from downloading files or printing documents.

Jon Oltsik, senior analyst with Enterprise Strategy Group, says technology must also exist on PCs and other devices not only to monitor what data is traversing the network, but to establish and enforce policies regarding printing and downloading information onto disks or USB devices. Companies such as Authentica and Liquid Machines sit on the client machine tracking and limiting how recipients handle certain information.

“There isn’t one technology that will solve this problem,” Oltsik said. “You really need to take a combination of approaches.”

The no-tech Trojan horse Once inside a company or one of its partners, a trusted employee can do enormous damage. Often such leaks disclose the most sensitive of data. “Insiders know where the information is located and how the security systems work,” Oltsik said. “They know what information is valuable and what’s not.”

http://news.zdnet.com/2100-1009_22-5520016.html

Spending on Secure Sockets Layer Virtual Private Networks (SSL VPN) will grow at a 53% compound annual growth rate, and SSL VPNs will surpass traditional IPsec VPNs as the de-facto remote access security standard by 2008, according to a new report from Forrester Research.

In “SSL VPNs Poised for Significant Growth,” Forrester associate analyst Robert Whiteley says companies are attracted by the technology’s application-level simplicity.

Unlike IPsec VPNs, which require special client software to access the network, SSL VPN supports a wide range of devices, from desktop computers to PDAs, and applications, while offering network administrators greater granularity of user information and providing better endpoint security.

According to the report, some 44% of American businesses have deployed SSL VPNs, spending $97 million on the technology last year alone. Despite the impressive adoption rate for a technology that has been in the business mainstream for less than a year, Forrester expects SSL VPN deployments to continue to take off, with the market growing at a 53% compound annual growth rate to $1.2 billion in 2004.

SSL VPNs are already well-entrenched in the financial and business services industries and in the public sector. Driven by the need to ensure endpoint security for online services, the financial services industry can boast a 56% penetration rate, with business services just behind at 51%.

In both cases, Whiteley predicts a compound annual growth of 34% to 2010 which, though impressive, pales beside the expected SSL VPN growth in late-adopting industries. Indeed, Whiteley writes that retail and manufacturing are poised to leap into SSL VPN with gusto over the next few years.

“Retail and wholesale allocates 7.8% of its IT spend to security — more than even financial services,” he notes.

http://informationweek.com/story/showArticle.jhtml?articleID=56900844